Department-level authorization bypass in holdaction, blockuser, and transferchat endpoints

Vulnerability

Three chat action endpoints load chat objects by ID without calling erLhcoreClassChat::hasAccessToRead(), allowing operators to act on chats in departments they are not assigned to.

Affected Endpoints

1. holdaction.php - erLhcoreClassModelChat::fetchAndLock($chat_id) without hasAccessToRead()
2. blockuser.php - erLhcoreClassChat::getSession()->load(...) without hasAccessToRead()
3. transferchat.php - erLhcoreClassModelChat::fetch(...) without hasAccessToRead()

Secure Pattern

Adjacent endpoints correctly call erLhcoreClassChat::hasAccessToRead($chat) before acting:

• sendmail.php (line 9)
• saveremarks.php
• previewchat.php
• modifychat.php
• singleaction.php
• chathistory.php

The hasAccessToRead() function (line 1606 of lhchat.php) enforces department-level access control.

Impact

Operators with the relevant role permissions (holduse, allowblockusers, allowtransfer) can hold, block users from, or transfer chats in departments they are not assigned to. This is a horizontal privilege escalation within one organization.

Suggested Fix

Add erLhcoreClassChat::hasAccessToRead($chat) check after loading the chat object in all three affected endpoints, matching the pattern used in sendmail.php and other siblings.